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AO 93 (SDNY Rev. 05/10) Search and Seizure Warrant ‘ef 


UNITED STATES DISTRICT COURT 


for the 
Southern District of New | 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Case No. 


A Laptop Computer, Further Described Below and in 
Attachment A 


eeveevesvs 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located inthe _ Southern District of _New York 
(identify the person or describe the property to be searched and give its location): 

A Laptop Computer, Further Described As a Silver Dell Inspiron 15 7000 Series (7548) Laptop Computer Bearing 
Service Tag 3RJJK42, Containing a Toshiba One Terabyte Hard Drive Bearing Serial Number X42LC13NT, and That 
ls Currently Housed at the Federal Bureau of Investigation, New York Field Office, as described in Attachment A. 

The person or property to be searched, described above, is believed to conceal (identify the person or describe the 


property to be seized): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


property. . 
YOU ARE COMMANDED to execute this warrant on or before A 13/ TG 
(not to exceed 14 days) 
© inthe daytime 6:00 a.m. to 10 p.m. @ at any time in the day or night as I find reasonable cause has been 


established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to the Clerk of the Court. 
we Upon its return, this warrant and inventory should be filed under seal by the Clerk of the Court. _KNF 
USMJ Initials 


CI find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the persor who, or whose property, will be 
searched or seized (check the appropriate box) Cifor ___ days (not to exceed 30). 


i Oluntil, the facts justifying, the later specific date of 
2132 Am, 


Date and time issued: (0 ([30(l¢ (Cevi— Latbauuh Prt 


City and state: New York, New York _ 
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AO 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) 


Return 


Date and time warrant executed: ia of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant 
to the Court. 


Executing officer's signature 


Printed name and title 
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ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 02-06-2019 BY Cé6w46B11 NSICG 


Attachment A 
I Device To Be Searched 


The device to be searched is a silver Dell Inspiron 15 7000 Series (7548) laptop computer 
bearing service tag 3RJJK42, containing a Toshiba one terabyte hard drive bearing serial 
number X42LC13NT (the Subject Laptop), and that is currently housed at the Federal 
Bureau of Investigation, New York Field Office, 26 Federal Plaza, New York, New York 
10278. 


It. Review of ESI on the Subject Devices 


Law enforcement personnel (including, in addition to law enforcement officers and 
agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the ESI contained on the Subject Laptop for the following evidence, 
contraband, fruits, and/or other items illegally possessed in violation of Title 18, United States 
Code, Section 793(e) and (f) (the Subject Offenses): 


1 Data and information associated with the operation, use, maintenance, backup, 
auditing, and security functions of the Subject Laptop including, but not limited to: 
a. Emails and attachments, in any form; 
b. User and system files stored on the laptops, including file fragments and 


items carved from unallocated space; 


c. Logs, configuration files, and backups; 
d. Executable code and scripts; and 
e. Documents, database files, and spreadsheets; 
2: Data and information electronically stored on the Subject Laptop related to 


communications with email accounts used by former Secretary of State Hillary Clinton during 
her tenure as Secretary of State; 


3. Data and information on the Subject Laptop that might identify the person or 
persons who accessed classified information present on the Subject Laptop, including names, 
addresses, telephone numbers and other identifiers, email addresses, business information, the 
length of service (including start date), types of services utilized, means and source of payment 
for services (including any credit card or bank account number), and information about any 
domain name registration; and 


4. Data and information stored on the Subject Laptop that might identify activity 
related to a computer intrusion, including, but not limited to evidence of malware or viruses, 
executable code or scripts, log files, audit files, system files, user and account information, IP 
addresses, computer hardware addresses, intrusion-detection logs, firewall and other network 
logs, anti-virus logs or anti-malware logs. 
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Ill. Seizure for Later Review of Electronically Stored Information 
A. Seizure of Computer and Media 


This warrant authorizes the seizure of a computer and electronic storage media as set 
forth below. In lieu of seizing any particular electronic storage media, this warrant also 
authorizes the copying of electronically stored information for later review. Electronic storage 
media which may be seized or copied include without limitation: 


Computer devices, electronic media and electronic storage devices, including, but not 
limited to, a computer, disk drives, modems, thumb drives, personal digital assistants, smart 
phones, digital cameras, and scanners and the data within the aforesaid objects relating to said 
materials, which may contain information within the scope of this warrant. 


Any physical keys, encryption devices, and similar physical items that are necessary to 
gain access to the computer equipment, storage devices or data mentioned above, or any 
passwords, password files, test keys, encryption codes or other information necessary to access 
the above-mentioned computer equipment, storage devices or data. 


B. Review of Electronic Storage Media and Electronically Stored Information 


Following creation of forensic image copies as may be necessary to preserve the integrity 
of seized electronically stored information, law enforcement personnel (who may include, in 
addition to law enforcement officers and agents, attorneys for the government, attorney support 
staff, and outside technical experts under government control) are authorized to review the seized 
information for information and data within the scope of this warrant. 


In conducting this review, law enforcement personnel may use various techniques to 
determine which files or other ESI contain evidence, contraband, fruits and/or other items 
illegally possessed in violation of the Subject Offenses. Such techniques may include, but shall 
not be limited to, surveying various file directories or folders and the individual files they 
contain; conducting a file-by-file review by “opening” or reading the first few “pages” of such 
files in order to determine their precise contents; “scanning” storage areas to discover and 
possibly recover recently deleted data; scanning storage areas for deliberately hidden files; and 
performing electronic “key word” searches through all electronic storage areas to determine 
whether occurrences of language contained in such storage areas exist that are related to the 
subject matter of the investigation. Forensically trained law enforcement personnel may also 
search for and attempt to recover “deleted,” “hidden,” or encrypted data to determine whether the 
data falls within the list of items to be seized as set forth in this affidavit. ESI that is responsive 
to the warrant will be identified and/or copied for further use in the investigation and any 
resultant prosecution. 
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ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
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UNITED STATES DISTRICT COURT 

SOUTHERN DISTRICT OF NEW YORK 
In the Matter of the Application of the United i 
States Of America for a Search Warrant for a | 
Laptop Computer, Further Described As a Silver j Agent Affidavit in Support of 
Dell Inspiron 15 7000 Series (7548) Laptop Application for Search Warrant 
Computer Bearing Service Tag 3RJJK42, 
Containing a Toshiba One Terabyte Hard Drive } 
Bearing Serial Number X42LC13NT, and That is } 
Currently Housed at the Federal Bureau of / 
Investigation, New York Field Office, 26 Federal H 
Plaza, New York, New York 10278. H 


TO BE FILED UNDER SEAL 


SOUTHERN DISTRICT OF NEW YORK) ss.: 
b6 


being dul. , di id bic 


INTRODUCTION AND AGENT BACKGROUND 


1. Ihave been employed as a Special Agent with the Federal Bureau of Investigation 
(FBJ) since June 1998. As a Special Agent, I have been assigned to the Criminal, 
Counterterrorism, and Counterintelligence Divisions of the FBI’s Washington Field Office. 
From 2010 to 2015, I served as a Supervisory Special Agent in the International Operations 
Division, where I supported Counterintelligence operations. In January 2015, I was assigned to 
the Counterintelligence Division in the Washington Field Office as a,Supervisory Special Agent 
responsible for investigating offenses involving espionage, illegal agents of foreign powers, 
United States trade sanctions, unauthorized retention and disclosure of classified and national 
defense information, and money laundering in furtherance of national security offenses. 

2. This affidavit relates to a criminal investigation concerning the improper 
transmission and storage of classified information on unclassified email systems and servers. 
The investigation began as a result of a review of emails undertaken by the U.S. Department of 


State (State Department) in connection with Freedom of Information Act (FOIA) litigation. 


HRC-13248 


During this FOIA review, it was determined that certain emails containing classified information 
were sent and received on systems unauthorized for the transmission or storage of such 
information. On or about July 6, 2015, the Inspector General for the Intelligence Community 
notified the FBI of a potential compromise of classified information involving the emails 
discovered through the FOIA review. After an initial review of the matter, the FBI opened a 
criminal investigation to, among other things, identify any unauthorized systems which the 
emails in question have transited, identify any person(s) who may have introduced classified 
information onto unauthorized systems and all circumstances surrounding such introduction, 
identify any person(s) who may have transmitted such information over any such systems, and 
identify whether classified information has been compromised through computer intrusions or 
unauthorized access into these systems. 

a: The FBI’s investigation has established that emails containing classified 
information were transmitted and stored on multiple forms of electronic media. One of the items 
identified as having contained such emails is a server which was used by former Secretary of 
State Hillary Rodham Clinton (Clinton) during her tenure at the State Department to transmit, 
receive, and store email for a personal email account or accounts she maintained (the Clinton 
Server). One domain on the Clinton Server was @clintonemail.com. 

4. In recent months, the FBI and the Department of Justice have made public 
statements concerning the conclusion of the investigation. However, as with any case, if new, 
pertinent information comes to light after an investigation is completed, the FBI will take 
appropriate investigative steps to determine the significance of that information. 

5. On September 26, 2016, a search warrant was issued under seal in the Southern 
District of New York in an unrelated investigation of Anthony Weiner (Weiner) for sexual 
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exploitation and child pornography-related offenses. This search warrant authorized the FBI to 
search an iPhone, an iPad, and a laptop computer that were used by Weiner and that were 
provided to a private security firm on his behalf on September 23, 2016. 

6. In executing the search of the laptop computer (the Subject Laptop) pursuant to 
the search warrant issued on September 26, 2016, FBI agents sorted the emails on the Subject 
Laptop to segregate emails within the scope of the warrant from those outside of it. As a result, 
the FBI reviewed non-content header information for emails on the Subject Laptop to facilitate 
its search. In so doing, the FBI observed non-content header information indicating that 
thousands of emails of Weiner’s then-wife, Huma Abedin (Abedin), resided on the Subject 
Laptop. Because Abedin’s emails were outside of the scope of the September 26 search warrant, : 
the FBI did not review the content of those emails. 

7. From January 21, 2009 to March 1, 2013, Abedin was employed at the State 
Department as the Deputy Chief of Staff to Clinton. The non-content header information that 
FBI agents reviewed on the Subject Laptop indicates that the emails on the Subject Laptop 
include emails sent and/or received by Abedin at her @clintonemail.com account and at a 
Yahoo! email account appearing to belong to Abedin, as well as correspondence between one or 
both of these accounts and State Department email accounts during and around Abedin’s tenure 
at the State Department. The FBI’s investigation of the improper transmission and storage of 
classified information on unclassified email systems and servers has established that emails 
containing classified information were transmitted through multiple email accounts used by 
Abedin, including her @clintonemail.com and Yahoo! email accounts. 

8. The Subject Laptop, which is a silver Dell Inspiron 15 7000 Series (7548) laptop 
computer bearing service tag 3RJJK42, containing a Toshiba one terabyte hard drive bearing 
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serial number X42LC13NT, is currently housed at the Federal Bureau of Investigation, New 
York Field Office, 26 Federal Plaza, New York, New York 10278, within the Southern District 
of New York, as described in Attachment A to this affidavit. There is probable cause to believe 
that the Subject Laptop contains evidence, contraband, fruits, and/or other items illegally 
possessed in violation of 18 U.S.C. § 793(e) and (f). 

9. I make this affidavit in support of an application pursuant to Rule 41 of the 
Federal Rules of Criminal Procedure for a warrant to search the Subject Laptop for the items and 
information described in Attachment A. The facts set forth in this affidavit are based on my 
personal knowledge, knowledge obtained during my participation in this investigation, and 
information from other FBI and U.S. Government personnel. Because this affidavit is submitted 
for the limited purpose of establishing probable cause in support of the application for a search 
warrant, it does not set forth each and every fact that I or others have learned during the course of 
this investigation. Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported in substance and part, except where 
otherwise indicated. 


STATUTORY AUTHORITY AND DEFINITIONS 


10. For the reasons set forth below, I believe that there is probable cause to believe 
that the Subject Laptop contains evidence, contraband, fruits, and/or other items illegally 
possessed in violation of Title 18, United States Code, Section 793(e) and (f). (the Subject 
Offenses). 

Li Under 18 U.S.C. § 793(e), “[w]hoever having unauthorized possession of, access 
to, or control over any document . . . or information relating to the national defense which 
information the possessor has reason to believe could be used to the injury of the United States 
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or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes 
to be communicated, delivered, or transmitted” or attempts to do or causes the same “to any 
person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer 
or employee of the United States entitled to receive it” shall be fined or imprisoned not more 
than ten years, or both. 

12. Under 18 U.S.C. § 793(f), “[w]hoever, being entrusted with or having lawful 
possession or control of any document . . . or information, relating to the national defense” either 
“(1) through gross negligence permits the same to be removed from its proper place of custody 
or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed,” or 
“(2) having knowledge that the same has been illegally removed from its proper place of custody 
or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and 
fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer” 
shall be fined or imprisoned not more than ten years, or both. 

13. Under Executive Order 13526, information in any form may be classified if it: (1) 
is owned by, produced by or for, or is under the control of the United States Government; (2) 
falls within one or more of the categories set forth in the Executive Order [Top Secret, Secret, 
and Confidential]; and (3) is classified by an original classification authority who determines that 
its unauthorized disclosure reasonably could be expected to result in damage to the national 
security. 

14. Where such unauthorized disclosure could reasonably result in damage to the 
national security, the information may be classified as “Confidential” and must be properly 
safeguarded. Where such unauthorized disclosure could reasonably result in “serious” damage 
to the national security, the information may be classified as “Secret” and must be properly 
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safeguarded. Where such unauthorized disclosure could reasonably result in “exceptionally 
grave” damage to the national security, the information may be classified as “Top Secret” and 
must be properly safeguarded. 

15. Classified information, of any designation, may be shared only with persons 
determined by an appropriate United States Government official to be eligible for access, and 
who possess a “need to know.” Among other requirements, in order for a person to obtain a 
security clearance allowing that person access to classified United States Government 
information, that person is required to and must agree to properly protect classified information 
by not disclosing such information to persons not entitled to receive it, by not unlawfully 
removing classified information from authorized storage facilities, and by not storing classified 
information in unauthorized locations. Ifa person is not eligible to receive classified 
information, classified information may not be disclosed to that person. In order for a foreign 
government to receive access to classified information, the originating United States agency 
must determine that such release is appropriate. 

16. Pursuant to Executive Order 13526, classified information contained on 
automated information systems, including networks and telecommunications systems, that 
collect, create, communicate, compute, disseminate, process, or store classified information must 
be maintained in a manner that: (1) prevents access by unauthorized persons; and (2) ensures the 
integrity of the information. 

17. 32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information. 
Specifically, 32 C.F.R. § 2001.43, titled “Storage,” regulates the physical protection of classified 
information. This section prescribes that Secret and Top Secret information “shall be stored in a 
GSA-approved security container, a vault built to Federal Standard (FED STD) 832, or an open 
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storage area constructed in accordance with § 2001.53.” It also requires periodic inspection of 
the container and the use of an Intrusion Detection System, among other things. 
18. As used herein, the following terms have the following meaning: 

a “Computer” means an electronic, magnetic, optical, electrochemical, or 
other high speed data processing device performing logical, arithmetic, or storage functions, and 
includes any data storage facility or communications facility directly related to or operating in 
conjunction with such device. See 18 U.S.C. § 1030(e)(1). 

b. “Directory” or “folder” means a simulated electronic file folder or 
container used to organize files and directories in a hierarchical or tree-like structure. 

c. “Electronically Stored Information” or “ESI” includes, consistent with 
Federal Rule of Criminal Procedure 41 and the Advisory Committee Comments to the 2009 
amendments, writings, drawings, graphs, charts, photographs, sound recordings, images, and 
other data or data compilations stored in any medium from which information can be obtained, 
including all types of computer-based information as may be developed over time. “Computer 
data” as used herein is synonymous with ESI. 

d. “File” means a collection of related data or information stored as a unit 
under a specified name on storage medium. Not all ESI is stored in files. 


PROBABLE CAUSE FOR SEARCH 


19. At all times relevant to this affidavit, Clinton and Abedin had security clearances, 
as described in paragraph 15 above. 

20. As aresult ofa records request from the State Department, Clinton produced to 
the State Department approximately 30,490 email communications sent to or from Clinton at the 
@clintonemail.com domain that resided on Clinton’s Server. As a result of a FOIA request, the 
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State Department ultimately reviewed these 30,490 emails. The FOIA process implemented by 
the State Department required that these emails be reviewed by government agencies for 
classified information prior to public release. In February 2016, the State Department completed 
its review and determined that 2,115 of the 30,490 emails contain information that is presently 
classified. Out of these 2,115 emails, the State Department determined that 2,028 emails contain 
information classified at the Confidential level; 65 contain information classified at the Secret 
level; and 22 contain information classified at the Top Secret level. The State Department did 
not make a determination as to whether the information in these emails was classified at the time 
that the emails were sent. 

21. The U.S. Government’s determination that 2,028 emails contain information 
classified at the Confidential level is significant because it means that the unauthorized , 
disclosure of those emails could result in damage to national security. The U.S. Government’s 
determination that 65 emails contain information classified at the Secret level is significant 
because it means that the unauthorized disclosure of those emails could result in serious damage 
to national security. The U.S. Government’s determination that 22 emails contain information 
classified at the Top Secret level is significant because it means that the unauthorized disclosure 
of those emails could result in exceptionally grave damage to national security. 

22. In conjunction with this investigation, the FBI sought a determination by the 
relevant original classification authorities as to whether certain of the 30,490 emails contained 
classified information at the time they were sent. In response to the FBI’s requests for : 


classification determinations, the relevant original classification authorities determined that 81 
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email chains,' which the FBI investigation determined were transmitted and stored on the 
Clinton Server, contained classified information ranging from the Confidential to Top 
Secret/Special Access Program levels at the time they were sent between 2009 and 2013. The 
relevant original classification authorities determined that information in 68 of these email chains 
remains classified. 

23. Ina voluntary interview with the FBI on April 5, 2016, Abedin stated that she was 
issued an official State Department email account, abedinh@state.gov, which she used for State 
Department-related work. She also stated that she had an email account on the 
@clintonemail.com domain, huma@clintonemail.com, which she primarily used for matters 


related to Clinton’s personal affairs and to communicate with Clinton’s staff and friends. Abedin 


also stated that she had a personal Yahoo! email account| ___ yahoo.com. ae 


a 7 ‘ e OTHER Sealed 
According to Abedin, she could access her @clintonemail.com account and her Yahoo! account 


via the internet on the unclassified State Department computer system. Abedin at times also 
used her @clintonemail.com and Yahoo! email addresses to conduct State Department business. 
For example, she would use these accounts if her State Department account was down or if she 
needed to print an email or document. Abedin explained that it was difficult to print from the 
State Department system, and she routinely forwarded emails from her State Department account 
to her non-State Department accounts so she could more easily print. 

24. The FBI’s investigation determined that Abedin, using her various email 
accounts, typically communicated with Clinton’s @clintonemail.com email account on a daily 
basis. Analysis of emails in the FBI’s possession revealed more than 4,000 work-related emails 


' For the purpose of the FBI investigation, an email chain is defined as a set of emails having the same initial email. 
The subject line may be edited in these chains to reflect the purpose of the forward or reply. 
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between Abedin and Clinton from 2009 to 2013. 

25. The FBI’s investigation established that 27 email chains containing classified 
information, as determined by the relevant original classification authorities, have been 
transmitted through Abedin’s @clintonemail and/or Yahoo! accounts. Out of the 27 email 
chains, six email chains contained information that was classified at the Secret level at the time 
the emails were sent, and information in four of those email chains remains classified at that 
level now, while two email chains contain information that is currently classified at the 
Confidential level. Information in the remaining 21 email chains was classified at the 
Confidential level at the time the emails were sent, and of those 21 email chains, information in 
16 of them remains classified as Confidential. 

26. Given the information indicating that there are thousands of Abedin’s emails 
located on the Subject Laptop — including emails, during and around Abedin’s tenure at the State 
Department, from Abedin’s @clintonemail.com account as well as a Yahoo! account appearing 
to belong to Abedin — and the regular email correspondence between Abedin and Clinton, there 
is probable cause to believe that the Subject Laptop contains correspondence between Abedin 
and Clinton during their time at the State Department. Because it has | been determined by 
relevant original classification authorities that many emails were exchanged between Abedin, 
using her @clintonemail.com and/or Yahoo! accounts, and Clinton that contain classified 
information, there is also probable cause to believe that the correspondence between them 
located on the Subject Laptop contains classified information which was produced by and is 
owned by the U.S. Government. The Subject Laptop was never authorized for the storage or 
transmission of classified or national defense information. 

27. A complete forensic analysis and review of the Subject Laptop will also allow the 
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FBI to determine if there is any evidence of computer intrusions into the Subject Laptop, and to 
determine if classified information was accessed by unauthorized users or transferred to any 
other unauthorized systems. 


PROCEDURES FOR SEARCHING ESI 


Review of ESI 

28. Law enforcement personnel (including, in addition to law enforcement officers 
and agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) will 
review the ESI contained on the Subject Laptop for information responsive to the warrant. 

29. In conducting this review, law enforcement may use various techniques to 
determine which files or other ESI contain evidence, contraband, fruits, and/or other items 
illegally possessed in violation of the Subject Offenses. Such techniques may include, for 
example: 

e surveying directories or folders and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a 
drawer believed to contain pertinent files); 

¢ conducting a file-by-file review by “opening” or reading the first few “pages” of such 
files in order to determine their precise contents (analogous to performing a cursory 


examination of each document in a file cabinet to determine its relevance); 


e “scanning” storage areas to discover and possibly recover recently deleted data; 
scanning storage areas for deliberately hidden files; and 


« performing electronic keyword searches through all electronic storage areas to 
determine the existence and location of search terms related to the subject matter of 
the investigation. (Keyword searches alone are typically inadequate to detect all 
information subject to seizure. For one thing, keyword searches work only for text 
data, yet many types of files, such as images and videos, do not store data as 
searchable text. Moreover, even as to text data, there may be information properly 


11 


HRC-13258 


subject to seizure but that is not captured by a keyword search because the 
information does not contain the keywords being searched.) 


30. | Law enforcement personnel will make reasonable efforts to restrict their search to 

data falling within the categories of evidence specified in the warrant. 
Return of the Subject Laptop 

31. Ifthe Government determines that the Subject Laptop is no longer necessary to 
retrieve and preserve the data on the device, and that the Subject Laptop is not subject to seizure 
pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return the Subject _ 
Laptop. Computer data that is encrypted or unreadable will not be returned unless law. 
enforcement personnel have determined that the data is not (i) an instrumentality of the offense, 
(ii) a fruit of the criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) 


evidence of the subject offenses. 


CONCLUSION 
32. Based on the foregoing, I respectfully request the Court to issue a warrant to seize 
the items and information specified in Attachment A to this affidavit and to the Search and 


Seizure Warrant. 
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33. In light of the confidential nature of this investigation, the full scope of which is 
not known to Abedin or the public, as well as the confidential nature of the underlying 
investigation in which the Subject Laptop was initially obtained by the Government, I 
respectfully request that this affidavit and all papers submitted herewith be maintained under seal 


until the Court orders otherwise. 


b6 
b7C 
OTHER Sealed 


Supervisory Special Agent 
Federal Bureau of Investigation 


Sworn to before-me on 
the 30th day of October, 2016. 


8/K evin Nathaniel Fox 


HON. KEVIN NATHANIEL FOX 
UNITED STATES MAGISTRATE JUDGE 
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AO 93 (SDNY Rev. 05/10) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of New York 
In the Matter of the Search of ) 
(Briefly describe the property to be searched ) M PY. 
or identify the person by name and address) J C 0 3 
A Laptop Computer, Further Described Below and in ; 
Attachment A ) 
SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern District of New York 
(identify the person or describe the property to be searched and give its location): 
A Laptop Computer, Further Described As a Silver Dell Inspiron 15 7000 Series (7548) Laptop Computer Bearing 
Service Tag 3RJJK42, Containing a Toshiba One Terabyte Hard Drive Bearing Serial Number X42LC13NT, and That 
\s Currently Housed at the Federal Bureau of Investigation, New York Field Office, as described in Attachment A. 
The person or property to be searched, described above, is believed to conceal (identify the person or describe the 


property to be seized): 


See Attachment A 
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. ' 


YOU ARE COMMANDED to execute this warrant on or before 4 4 (A FZ, V4 b 


(not tofexceed 14 days) 
0 in the daytime 6:00 a.m. to 10 p.m. DH at any time in the day or night as I find reasonable cause has been 
established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to the Clerk of the Court. 
0 Upon its return, this warrant and inventory should be filed under seal by the Clerk of the Court. 
USMJ Initials 


CO [ find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose preperty, will be 


searched or seized (check the appropriate box) Oifor days (not to exceed 30). 
/ Ly 32, ws Guntil, the facts justifying, the later specific dateof 
Date and time issued: (0) Vite S/Kevin Nathaniel Fox 
Judge's signature 
City and state: _New York, New York Honorable Kevin Nathanie! Fox 


Printed name and title 


HRC-13261 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 02-06-2019 BY Cééw46B11 NSICC 


AO 93 (SDNY Rev. 05/10) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of New York 
In the Matter of the Search of ) 1 M AG ; 
(Briefly describe the property to be searched ) 
or identify the person by name and address) ) Case No. 
A Laptop Computer, Further Described Below and in : 
Attachment A ) 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern District of New York 
(identify the person or describe the property to be searched and give its location): 
A Laptop Computer, Further Described As a Silver Dell Inspiron 15 7000 Series (7548) Laptop Computer Bearing 
Service Tag 3RJJK42, Containing a Toshiba One Terabyte Hard Drive Bearing Serial Number X42LC13NT, and That 
Is Currently Housed at the Federal Bureau of Investigation, New York Field Office, as described in Attachment A. 
The person or property to be searched, described above, is believed to conceal (identify the person or describe the 


property to be seized): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


property. v/ i 
YOU ARE COMMANDED to execute this warrant on or before //2 f ss 
(rbot to exceed 14 days) 


© inthe daytime 6:00 a.m. to 10 p.m. @ at any time in the day or night as i find reasonable cause has been 
established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to the Clerk of the Court. 
OC Upon its return, this warrant and inventory should be filed under seal by the Clerk of the Court. 4 O 
USMJ Initials 


C I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, cr whose property, will be 


searched or seized (check the appropriate box) Ofor _ _ days (not to exceed 36). 
1. ‘Zi 2 until, the facts justifying, the later specific dateof 
Date andtime issued: /O/ROUL S/Kevin Nathaniel Fox 
Judge's signature 
City and state: New York, New York Honorable Kevin Nathaniel Fox 


Printed name and title 


HRC-13264 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 02-06-2019 BY Césw46B11 NSICG 
AO 106 (Rev. 06/09) Application for a Search Wsegant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of New York 
In the Matter of the Search of ] 6 M AG 
(Briefly describe thi to be ched q 
Cy rie trope ob ed 706 3 


) 
) 
) 
A Laptop Computer, Further Described Below and in ) 
Attachment A } 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
PY REE fear eat ee ae As a Silver Dell Inspiron 15 7000 Series (7548) Laptop Computer Bearing 

Service Tag 3RJJK42, Containing a Toshiba One Terabyte Hard Drive Bearing Serial Number X42LC13NT 
located in the Southern District of New York , there is now concealed (identify the 
person or describe the property to be seized): 


PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
& contraband, fruits of crime, or other items illegally possessed; 
C1 property designed for use, intended for use, or used in committing a crime; 
Ca person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 793(e) and (f) Gathering, transmitting or losing defense information 


The application is based on these facts: 
PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. 


& Continued on the attached sheet. 
© Delayed notice of __ days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 
“b6 
b7c 


licant’s signature OTHER Sealed 
_ [reve eee 


Printed name and title 


Sworn to before me and signed in my presence. 


8/Kevin Nathaniel Fox 
Date: 10/30/2016 
Judge’s signature 
City and state: New York, New York Henorable Kevin Nath Fox 


Printed name and tide 


HRC-13267 


ALL INFORMATION CONTAINED 


HEREIN IS UNCLASSIFIED 
DATE 02-06-2019 BY CééwW46B11 NSICG 


LAW OFFICES 
WILLIAMS & CONNOLLY LLP 
725 TWELFTH STREET, N.W. 
WASHINGTON, D. C. 20005-5901 EDWARD BENNETT WILLIAMS 020-1988) 


PAUL R. CONNOLLY 1922-1978) 


DAVID E. KENDALL 
(202) 434-5145 (202) 434-5000 


dkendall@we.: 
_. FAX (202) 434-5029 


November 17, 2016 


BY E-MAIL 


b6 
U.S. Department of Justice ue 


National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 


Def 

As you know, from our first conversations in July 2015, former Secretary of State Clinton 
has voluntarily cooperated with your security inquiry, repeatedly providing information, devices, 
and testimony at your request. This voluntary cooperation has been documented in the letters we 
have exchanged since then. On July 5, 2016, FBI Director Comey announced that this inquiry 
had concluded that no criminal charges should be sought in the matter of Secretary Clinton’s use 
of personal email, and on November 6, 2016, Director Comey re-confirmed this conclusion. 


I write now regarding the disposition of the equipment, devices, and data that Secretary 
Clinton and Williams & Connolly LLP voluntarily provided to the Department of Justice in 2015 
and earlier this year in connection with its inquiry. 


In consenting to the voluntary production of these items, I stated our expectation that the 
devices, as well as any non-federal record data on the devices, would be ret to us at the 
conclusion of your inquiry. Se 1, 2015 Letter from D. Kendall ‘maou 7S 23, b6 
2016 Letter from D. Kendall meres fae Director Comey’s statements that the inquiry is B7G 
now concluded, we request the return of the devices, equipment, and non-federal record data 
contained on those items, and ask that you advise us as to the date on which these items will be 
returned. 


b6é 
cc: b7c 


HRC-13283 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 


Agent Copy DATE 02-06-2019 BY Cé6w46B11 NSICG 
== = 


UNITED STATES DISTRICT COURT 
for the 
Southern District of New 4 | 


A093 (SDNY Rev. 05/10) Search and Seizure Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


ALaptop Computer, Further Described Below and in 
Attachment A 


veers 
Zz 
S 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located inthe _ Southern District of _ New York __ 
(identify the person or describe the property to be searched and give its location): 
A Laptop Computer, Further Described As a Silver Dell Inspiron 15 7000 Series (7548) Laptop Computer Bearing 
Service Tag 3RJJK42, Containing a Toshiba One Terabyte Hard Drive Bearing Serial Number X42LC13NT, and That 
Is Currently Housed at the Federal Bureau of Investigation, New York Field Office, as described in Attachment A. 
The person or property to be searched, described above, is believed to conceal (identify the person or describe the 


property to be seized): 


See Attachment A 


1 find that the affidavit(s), or any recorded testimony, establish probable cause te search and seize the, person or 
property. ; 


YOU ARE COMMANDED to execute this warrant on or before = Uf 3 [té oes 7 
‘(not fo exceed 14 days) © 

© in the daytime 6:00 a.m. to 10 p.m. SD at any time in the day or night as I find reasonable cause has béen 

established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a teceipt for the property f 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to the Clerk of the Court. 
{M Upon its return, this warrant and inventory should be filed under seal by the Clerk of the Court. 
USMJ Initials 


© I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the persori Who} or whose property, will be 
searched or seized (check the appropriate box) Ofor ____days (not fo exceed 30); U 
Guntil, the facts justifying, the later specific date of 
(2132 Bm, janie 


Date and time issued: (0 [30f 1G (Ceviin i act 
; |, Judge's signature : 
City and state: New York, New York __ Honorable-Kevin Nathariel Fox ae 


Printedname and title 


Agent COpy 


HRC-13300 


A093 (Rev. 01/09) Search and Seizure Warrant (Page 2) 


Return 


Case No.: Date and time warrant executed: Copy of warrant and inventory left with: 
16 MAG 7063 10/30/2016 1:57 pm SS, 
Inventory made in the presence of : s ‘ee OTHER Sealed 


Inventory of the property taken and name of any person(s) seized: 


Forensic image of a silver Dell Inspiron 15 7000 Series (7548) laptop computer 
bearing service tag 3RJJK42 containing a Toshiba one terabyte hard drive bearing 
serial number X42LC13NT. 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant 
to the Court. 


b6 
b7c 
OTHER Sealed 


Date: _ 10/30/2016 : 
Executing officer's signature 


ssaL__ de 


Printed name and title 


HRC-13301 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 02-06-2019 BY CéeW46B11 NSICG 


‘AO 106 (Rev. 06/09) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of New York 


16.MAG 7063 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


) 
) 
) 
A Laptop Computer, Further Described Below and in ) 

Attachment A } 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
he sen nal ‘oi? 
PR Rab top seared and aie te Beeotiod As a Silver Dell Inspiron 15 7000 Series (7548) Laptop Computer Bearing 
Service Tag 3RJJK42, Containing a Toshiba One Terabyte Hard Drive Bearing Serial Number X42LC13NT 
located in the Southern District of New York , there is now concealed (identify the 
person or describe the property to be seized): 


PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
of evidence of a crime; 
& contraband, fruits of crime, or other items illegally possessed; 
© property designed for use, intended for use, or used in committing a crime; 
CO aperson to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 793(e) and (f) Gathering, transmitting or losing defense information 


The application is based on these facts: 
PLEASE SEE ATTACHED AFFIDAVIT AND ATTACHMENT A. 


& Continued on the attached sheet. 


OF Delayed notice of days (give exact ending date if more than 30 days: —s——_—) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


SY 2 _+f— 


Applicant's signature 


Richard A. Mains, Supervisory Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


S/Kevin Nathaniel Fox 
Date: 10/30/2016 
Judge's signature 
City and state: New York, New York Honorable Kevin Nathaniel Fox 


Printed name ard title 


HRC-13304 


DECLASSIFIED BY: NSICG CééW46B11 
ON 02-06-2015 


* = Rev.-05-01-2008) 


SEGRET/ /NOFORIt 
FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 11/17/2016 
To: Washington Field 


From: Washington Field 
CI-13 


Contact: sal : 
b6é 
. b7c 
Approved By: DIE 
Drafted By: 
Title: 23(/H) MIDYEAR EXAM; 
MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 
Synopsis: (U//fese) This communication documents analysis of a 


Dell Inspiron 15 7000 Series laptop computer seized via Search 
and Seizure Warrant (Case No. 16MAG7063) obtained in the 
Southern District of New York. 


Classified By: F42M81K72 
Derived From: FBI NSIC dated 20130301 
Declassify On: 20411117 


Details: (U//fS68C) On October 30, 2016, a federal search and 
seizure warrant (Case No. 16MAG7063) was obtained in the 
Southern District of New York for a silver Dell Inspiron 15 7000 
series laptop computer bearing service tag 3RJJK42, containing a 
Toshiba one terabyte hard drive bearing serial number X42LC13NT. 
The scope of the foregoing warrant allowed law enforcement 
personnel to search the laptop for data and information relating 
to communications with email accounts used by former Secretary 
of State Hillary Clinton during her tenure as Secretary of 
State. 


(U/ P68) A forensic search for all email files in 
both the allocated and unallocated portions of the hard drive of 
the target laptop revealed approximately[ __Jemail files. In b7E 
order to adhere to the scope of the warrant, additional filters 
were applied to identify communications with email accounts used 


1 


“SEGRET/ AV@PORN. 


HRC-13305 


‘> Rev-05-01-2008) 


USEGRET/ /NOPORN- 
FEDERAL BUREAU OF INVESTIGATION 


by Hillary Clinton. After minimizing duplication across the 


mail data when possible, the FBI then reviewed approximately 
[—[tetar email files deemed to be within the scope of the 


warrant. 


b7E 


FBI identified email chains that - through prior 
investigation - were determined to be classified. of the 
emails were classified as SECRET at_the time sent, 


of which remain cl ified SECRET and f which remains 
classified CONFIDENTIAL. of the 


emails were 
classified as CONFIDENTIAL at the time sent, 


(U//P@80) In the review of the[__Jemail files, the DIE 


of which 
remain classified CONFIDENTIAL and[__]of which are now 
unclassified. 


w//eevex[ Jot the fF] previously discovered kb 
classified email chains were forwarded to former Congressman 


Anthony Weiner - without comment - by his then spouse, Huma 
Abedin. 


USESRET/ /NOFORN- 


HRC-13306 


ALL INFORMATIGN CONTAINED 
HEREIN IS UNCLASSIFIED 


18-1 (Rev. 08-15-2015) UNCLASSIFIED DATE 02-06-2019 BY CééW46B11 NSICG 


Federal Bureau of Investigation Operational Technology 
es . ERF Building 27958A 
Digital Evidence Laboratory Quantico, Virginia 22135 


REPORT OF EXAMINATION 


Ta: Washington Fi. Fi Date: March 6, 2017 
j b3 
Request No.: 150806250 b7C 
Request Date: August 6, 2015 bIE 


Ref.No.: Service Request ID 172263 
Title: MIDYEAR EXAM 


Date item(s) received: | August 6, 2015 and thereafter as described below 


Item(s) Submitted: 


bIE 


Page lof 18 
An ASCLD/LAB-internotional 


Accredited Laboratory 
Since January 16, 2007 


UNCLASSIFIED 


HRC-13307 


UNCLASSIFIED 


b3 

b6é 

b7A 

bic 

b7E 

Request: 
On August 6, 2015, Supervisory Special Agent (ssa =o the b6 

b7c 


CounterIintelligence Division (CD) requested a search of the submitted evidence items which 
was later documented on Computer Analysis Response Team (CART) Request for Service ID 
172263. The searches were authorized by consent to search agreements and federal search 
warrants. 


ssA____Jand WFO investigative personnel requested initially and over the course of the b6é 

examination that the items be searched fo! bic 
egarding use and access of specific devices and computers, and bIE 

information about activity possibly related to device intrusion. 

WFO investigative personnel requested that some of the items be filtered through a 

designated FBI Filter Team prior to being reviewed by the FBI Investigative Team. 


The chart below lists all submitted items and the FBI review team initially assigned to each 
item. 


150806250 
Page 4 of 18 
UNCLASSIFIED 


HRC-13310 


UNCLASSIFIED 


Short Description/Source Review Team 


b7E 
Investigative 


Investigative 


Investigative 


Investigative 


Investigative 


150806250 
Page 5 of 18 
UNCLASSIFIED 


HRC-13311 


150806250 
Page 6 of 18 


UNCLASSIFIED 


UNCLASSIFIED 


Filter 


Filter 


Unexamined 


Investigative 


Filter 


Investigative 


Investigative 


Investigative 


Investigative 


HRC-13312 


b7E 


UNCLASSIFIED 


bé 


Investigative b7c 
b7E 


Investigative 


Filter 


Investigative 


Investigative 


Investigative 


Filter 


Filter 


Investigative 


Filter 


Filter 


Filter 


150806250 
Page 7 of 18 


UNCLASSIFIED 


HRC-13313 


UNCLASSIFIED 


b7E 


investigative 


Investigative 


The FBI Investigative Team also requested that working copies of specific items be reviewed 
pertaining to activity possibly related to device intrusion. This review was coordinated and at 
different points conducted by either Cyber Division FBI or personnel from the FBI 
Operational Technology Division (OTD). 


Throughout the course of the investigation, the FBI Investigative Team requested that 
specific items be exported and disseminated for further review. 


Summary of Results: 


The examination was conducted by Forensic Examiner: b6 
and ith technical assistance provided by Computer Scientist: nig 
ind Forensic cence 


The original evidence items were copied, thereby creating “workin, ” of the originals. 


The working copies of items assigned to the FBI Filter Team were 


b7E 


Items responsive to 
these searches ind provided to the FBI Filter Team for 


review. 


Items assigned to the FBI Investigative Team were de-duplicated (as requested) and 
provided for review without prior filtering for search terms. Timeline reporting regarding use 
and access of specific devices and computers was also provided to the FBI Investigative Team 
for review. 

Per request by the FBI Investigative Team, working copies of specific items were provided to 
either the “FBI Cyber Division” or OTD personnel for review pertaining to activity possibly 
related to device intrusion. 


Per request by the FBI Investigative Team, specific mailboxes fron[___] believed to be 


- jive were exported and provided for return to Platte River Networks (PRN) 
b7E 


Throughout the course of the investigation, items flagged by the FBi Investigative Team were 
exported and disseminated for further review. 


150806250 


Page 8 of 18 
UNCLASSIFIED 


HRC-13314 


UNCLASSIFIED 


Details of Examination: 
FBI Filter and Investigative Team Review: 


ere 
was no indication that the content of the provided file was altered. 


Items were = = — techniques | 


The working copies of the items assigned to the FBI Filter Team were searched by the 
Operation Technology Division’s FBI Examination Team using the following search terms to 
identify email account and domain activity of interest: 


b7E 


b6 
b7c 
b7E 


Items responsive tothe searchef_SSC~C~CSCSCSCSCSCSC*idt thee FBI Examination b7E 


Team and provided to the designated review team. If applicable, items marked “Cleared by 
the FBI Filter Team” were made available for review by the FBI Investigative Team. 


Timeline reporting and review of use and access of specific devices and computers 


The FBI Examination Team searched the following items | b7E 


b7E 


150806250 


Page 9 of 18 
UNCLASSIFIED 


HRC-13315 


UNCLASSIFIED 


b7E 
b7E 
for items of interest were reviewed by the FBI Examination 

Team and provided to the FBI Investigative Team. 

In addition to the items that were disseminated for review during the course of the 

examination (as outlined in the “Derivative Evidence/Copies” section of this report), the 

following responsive files, artifacts, and timeline data were marked for review per the FBI 

Investigative Team’s request and later 
b7E 


150806250 
Page 10 of 18 


UNCLASSIFIED 


HRC-13316 


UNCLASSIFIED 


b7E 
Review of information about activity possibly related to device intrusion 
The FBI Examination Team provided the following items to the FBI Cyber Division or OTD 
personnel for review of information about activity possibly related to device intrusion: 
b7E 


150806250 
Page 11 of 18 
UNCLASSIFIED 


HRC-13317 


UNCLASSIFIED 


b7E 


All processed case data used by the FBI Examination Team were copied to a hard disk drive and 
labeled a: 


All processed case data used by the FBI ina} Team and the FBI Filter Team were copied 


to six (6) hard disk drives and labeled a: b7E 


Responsive files, artifacts, and timeline data were exported to a DVD and labeled | 
for review by the FBI Investigative Team. 


Upon completion of the examination, all images were forensically validated to confirm that 
they did not change during the examination process. 


Derivative Evidence/Copies: 
bE 


150806250 
Page 12 of 18 
UNCLASSIFIED 


HRC-13318 


UNCLASSIFIED 


b7E 


150806250 
Page 13 of 18 
UNCLASSIFIED 


HRC-13319 


UNCLASSIFIED 


b7E 


150806250 
Page 14 of 18 
UNCLASSIFIED 


HRC-13320 


UNCLASSIFIED 


b7E 


150806250 
Page 15 of 18 
UNCLASSIFIED 


HRC-13321 


UNCLASSIFIED 


b7E 


150806250 
Page 16 of 18 
UNCLASSIFIED 


HRC-13322 


UNCLASSIFIED 


b7E 


Disposition of Items: 


Original evidence items and results copy items were submitted back to the FBI Investigative 
Team as indicated above. Original evidence item: 
and derivative evidence item re being submitted 
back to the FBI Investigative Team. Per request of the FBI Review Team, case data made 
available to the review team during the course of the examination will remain available for 
administrative purposes until the Review Team indicates that administrative review of the 
data is no longer needed. 


b7E 


Additional working copies of media will be retained until such time as OTD is notified if it is 
authorized to destroy duplicate copies of data previously released on master and results 
items documented above. Upon receiving notification, OTD will destroy any copies 
remaining in its facilities and no electronic evidence will be retained at CART Headquarters. 


The notes of the examination are being placed in a Digital Evidence Laboratory (DEL) file 


jacket'and being retained in the FBI OTD file. 
b6é 


b7C 


Examiner: 


Computer Analysis Response Team 


b6 
b7C 


Examin| 


Operational Technology Division 
Computer Analysis Response Team 


150806250 


Page 17 of 18 
UNCLASSIFIED 


HRC-13323 


150806250 
Page 18 of 18 


UNCLASSIFIED 


Examine. 


UNCLASSIFIED 


Computer Analysis Response Team 


HRC-13324 


bé 
b7C 


DECLASSIFIED BY: NSICG Cé6w46B11 
ON 02-06-2019 


FD-1057 (Rev. 5-8-10) / 
FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


(0) Title: MF) Documents information provided by Date: 04/10/2018 


‘ia FBI-NY b7D 


From: WASHINGTON FIELD 


b6 


Case ID | (Uj) D8/ 4) MIDYEAR EXAM; 
MISHANDLING OF CLASSIFIED; 


UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


b7D 


assify On: 2043 


Enclosure(s): En sed are the following items 


Details: 


on 4/3/2018, ssal_______Jand_sa from WFO squad CI-13, b6 
conducted a Lync call with $§ ae 


FBI-NY_ squad CY-2 regardin 


BECRET//NOFORT 


HRC-13325 


SESRET //NOPFORN- 


{U) Title: ~DS/A¥P) Documents information provided vy[__via FBI-NY 
re: [—_] 04/10/2018 


(U//f@868) For background information, FBI-NY maintains 
investigation. As part of a related investigation] 
provided NY| 


lwas received by SA 
On 3/9/2018, 


Thereafter, SA 


and documented his findings inc _—ids 


(U//#O8@) NY agreed to provide WFO a copy[__—_—_—ite review for 
pertinence to the captioned investigation. NY noted the followin 
points which may indicate 


(u//Peve) on 4/9/2013, saf___ reviewed if it 
provided any new or substantive information about] 
After reviewing} 

was determined not to provide any relevant or actionable 


for_the reasons listed below: 


SEGRET//NOFORI- 


HRC-13326 


b3 
b7D 
b7E 


b6 

bIA 
b7c 
b7D 


b6 

b7A 
b7C 
b7D 
b7E 


b7D 
b7E 


b6 
b7c 
b7D 


b7D 


SECRET//NeFORN b3 


b7D 


Title /NF) Documents information provided by [ ]via FBI-NY bE 
Re: 04/10/2018 


b7D 
WFO _CI-13 is not_in a position to assess if b7D 
However, WFO defers to NY 
action they deem appropriate regarding 
b7D 


(U//Be8&) Based on this review, no further action regarding 
and the captioned matter is warranted by WFO CI-13 at this time. 


o¢ 


SECRET //NOFORN 


w 


HRC-13327 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
/ ™ DATE 02-06-2019 BY Cééw46B11 NSICG 


FD-340c(4-11-03) om 


b3 
File Number | See2e2_ lA bIE 
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